Glow Labs says AI coding agents install archived MCP servers from model memory, and no patch is coming

17,352,267 downloads of packages their own repository calls unmaintained

Glow Labs, the research team at Glow Security, says AI coding agents are installing deprecated MCP servers because they remember the package name from training, not because anyone chose it. The twelve packages in Glow's own download table add up to 17,352,267 downloads since 10 July 2025 (the sum is derived; Glow prints no end date for the count). The repository they came from carries a banner saying it was archived on 29 May 2025, which is 523 days before this briefing (derived). And npm's download API, read on 3 November 2026, puts the same twelve packages at 620,838 downloads in the most recent full week it reports, 27 October to 2 November (derived: the sum of twelve figures).

What those numbers do not establish is who or what downloaded them. They do not separate agents from humans, build servers or mirrors, and they say nothing about how many installs an agent chose for itself. Glow's headline split, 98% of sessions where the agent appears to have filled in the name from memory and 2% where the user asked for the old package by name, is a split among sessions that already involved a deprecated server. The post gives no count of sessions, no source for the transcripts and no method for choosing them, so it cannot be read as the rate at which agents make this mistake.

This briefing rests on Glow's post, read in full between about 11:24 and 11:35 UTC on Tuesday 3 November 2026, together with the archive page on GitHub, the GitHub and npm records for the packages, and Glow's home page for what the company sells. Help Net Security's summary of the same day is a secondary source, used only for an interview with a Glow researcher that the post does not carry. Glow sells endpoint security software and the post ends with a pitch for it, so read this as one vendor's research, not an independent measurement. Glow names Anthropic in two roles: as the origin of the archived packages, and as one of three model providers whose models were in the transcripts. This briefing follows what Glow printed and checks what it could.

What the post says happened

Glow says its researchers found the pattern while monitoring risky agentic behaviour and identifying MCP installs, then reviewing "real-world AI coding session transcripts". A developer asks an agent to connect a service, such as GitHub. The agent fills in the name of an early reference server from training data. It either writes the MCP configuration itself or hands the developer the command, and npm installs the deprecated package. In the GitHub example, the agent chose a deprecated Anthropic server over the one GitHub maintains itself. Glow says the repository is archived and that its archive notice says no security updates or bug fixes will be provided.

Glow says the pattern appeared in every harness and with every model provider in its transcripts. The harnesses were Claude Code, Cursor, Codex CLI, Claude Cowork and Claude chat, and the models came from Anthropic, OpenAI and xAI. It states that none of the sessions involved a malicious actor. It also says it appears that the reason for the choice, in 98% of the sessions where an agent set up a deprecated server, was the model's training data. The word is "appears": this is Glow's inference from transcripts, not a log of model reasoning.

Zoom

Four flaws, one described, and a maintainer reply that closes the door

The post describes only one of the four flaws. It is a remote code execution bug in the Puppeteer server, which lets an agent open a browser session. With a prompt injection, Glow says, an attacker can make the agent start any process on the machine instead of the browser and run any command. Why safeguards miss it, in Glow's words, is that the developer allowed the agent to browse the web and that permission ends up covering any command, so the harness does not stop it. Help Net Security's version is the same. Neither prints a version number, a score, a weakness class beyond "remote code execution", or the payload, and this briefing adds none.

Glow says it reported the bug. The maintainers replied that the server was archived in May 2025 and "is unmaintained, so no fix or release will come from this repository." They closed the report as out of scope and said they would look at marking the npm package deprecated so users are warned. The post's disclosure timeline gives four dates, shown below with the gap this site computed.

One check is possible from outside. The GitHub API record for the archived repository shows it as archived, and its list of published security advisories, read the same day, came back empty. That fits Glow's statement that no CVE exists, but it is not proof of it: this site did not search the CVE database or any CNA record, so the claim rests on Glow and on that one empty list. The post does not say what a CNA decided about the four reports, or whether a number was refused.

The download counts, checked against npm

Glow's table lists twelve packages by short name, such as server-github. Glow's text refers to the deprecated @modelcontextprotocol servers, and the npm registry confirms a package of each short name under that scope. This site re-read the counts through npm's download API for the span 10 July 2025 to 2 November 2026 and for the last week the API reports. The totals are higher than Glow's, which fits a window that ends later than Glow's (Glow prints no end date), and the packages fall in the same order. Eleven of the twelve match a server by name on the archive's list; create-server does not appear on that list (derived by comparing names).

The weekly column is the more telling one. Packages whose source repository was archived on 29 May 2025, and which npm now flags as deprecated, still draw hundreds of thousands of downloads a week between them. That is consistent with Glow's argument that usage has not followed the deprecations, but a download is a download: it could be an agent, a developer who copied an old tutorial, a container build that pins the name, or a mirror. A Glow researcher told Help Net Security that server-github had 185,239 downloads in its last week and six owners. The registry record this site read also lists six maintainers for that package, and the API gave 200,397 for the week to 2 November, a different week and so not a conflict.

A label on a package is not a control

Two comforting labels sit on these packages. The first is the scope: the name begins @modelcontextprotocol, which reads like the protocol's own. The second is the word reference. The archive page says the servers were "created to demonstrate MCP features and SDK capabilities", and the current servers README says reference servers are meant as educational examples and "not as production-ready solutions". An agent that picks a package because the name looks official has used a name as a trust signal, and the name was never a promise of upkeep.

The deprecation labels are thin as well. The GitHub archive page, as read, carries a security notice: no security guarantees, no security updates or bug fixes, use at your own risk. The npm registry JSON, read for all twelve packages, shows every version of every one marked deprecated, with a message that says only that the package is no longer supported and points to npm support. It does not mention the archive, any security issue, or a replacement. The registry does not say who set the flag or when. For the two packages this site read in full, the registry's own modified timestamp is 17 September 2026, before the October dates in Glow's timeline, and this site draws no conclusion from that: a modified timestamp can change for other reasons. What can be said is that on 3 November the flag is present, so the maintainers' remark that they would look at marking the package is either already done or refers to something this site could not see.

Glow's account of what agents do with the flag is the sharper point. It says a deprecated package disappears from npm search, which may explain why web searches came up empty, but npx will still install it with nothing more than a warning. A Glow researcher told Help Net Security that in one session the agent checked npm, got back "This package is deprecated", installed anyway and never told the user. The registry message this site read for these twelve packages is worded differently, so that session may have involved another package or the command line's own wording. The post does not say which, and this site cannot tell.

The archive's README also shows how uneven the signposting is. It lists fourteen archived servers, counted by this site; Glow says 13 of 20 reference servers were archived. The two figures are not reconciled in either source. For Brave Search the README names an official replacement. For Slack it says the server is now maintained by another company. For the GitHub server it names no replacement at all, which is the example the whole report turns on.

Why the usual controls stay quiet

Glow's table gives a reason for each control, and Help Net Security repeats them. Endpoint detection sees a trusted Node process installing a public npm package an agent requested, which looks routine. Software composition analysis reads manifests, and an npx server sits in none. The agent harness's guardrails govern what the agent may run, and the harness does not know the package is deprecated. Software inventory lists installed applications, and a server launched by npx runs inside a Node process. That leaves the endpoint, where the agent writes the config and runs the install, as the one place Glow says the issue shows up.

Zoom

The vendor interest is plain. Glow describes itself on its home page as controlling everything that runs on the endpoint, and the post closes with how its own platform finds, blocks and removes these servers, across more than 20 AI tools. That does not make the observation wrong: a server launched by npx without a manifest is a real blind spot for manifest based tools. It does mean the framing, that the answer is endpoint inventory, is the one the author sells. This site has not tested Glow's product or any control named above.

Who could fix it, according to a Glow researcher

Help Net Security's interview sets out four possible sources of a fix, in the Glow researcher's words. Harness makers could refuse deprecated servers or warn the operator, and cover servers already installed, though it works only if every harness does it. Model makers could update what models know, but the researcher calls that unlikely because changing weights is very expensive. Package owners could fix the bugs, the only fix that protects people who keep using the servers. Security companies can use pre execution hooks that many harnesses already support, which works today without waiting for the other three. Glow's post says its own product blocks calls to risky servers by policy, so the last option is also the one it sells.

Zoom

The researcher also explains why simply pulling the packages from npm is not an option: npm lets an owner remove one only if it had fewer than 300 downloads in the past week, has a single owner and no public dependents. On the figures above, server-github fails every test. The researcher says npm removes packages that contain malware but that no case of removal for vulnerabilities was found. This site did not read npm's policy pages (the host answered with a bot check), so those rules rest on the interview.

No harness or model maker's statement is linked from Glow's post or from Help Net Security's article, and this site did not find one on the vendors' own sites. Whether Anthropic, OpenAI, xAI or the makers of Cursor have responded is not stated.

What a security team can do, in order

Technical details

The primary sources print no payload, no configuration snippet, no query and no indicator beyond package names, so nothing below is an exploit artefact. What they do print is what a defender needs to recognise the packages, the archive notice and the state of the registry. Each block is copied as printed, with the source named in its caption; anything this site derived is marked.

The first block is the list of package names exactly as Glow's table prints them. They are short names. The registry confirms each exists under the @modelcontextprotocol scope. A defender searches configs for the scoped form.

server-github
server-postgres
server-slack
server-puppeteer
server-brave-search
server-google-maps
server-gitlab
server-gdrive
server-redis
create-server
server-aws-kb-retrieval
server-everart

The next block is a search pattern this site derived from those twelve names. It is a suggestion, not something Glow printed, and it was not run. It matches only the twelve, because other packages under the same scope, such as ones still maintained, are not part of this finding. The archive also lists Git, Sentry and SQLite servers that are not in Glow's npm table; this site did not check where those are published.

@modelcontextprotocol/(server-github|server-postgres|server-slack|server-puppeteer|server-brave-search|server-google-maps|server-gitlab|server-gdrive|server-redis|create-server|server-aws-kb-retrieval|server-everart)

This is the security notice on the archive's README, as the GitHub page showed it. It is the text Glow says agents do not pay attention to.

IMPORTANT: This repository is archived and no longer maintained.

NO SECURITY GUARANTEES ARE PROVIDED FOR THESE ARCHIVED SERVERS.
These servers are no longer maintained
No security updates or bug fixes will be provided
Use at your own risk

This is the start of the deprecation message the npm registry returned for every version of all twelve packages. A second sentence points to npm support and is not reproduced, because that page sits behind a bot check this site did not pass and so was not read.

Package no longer supported.

This is the maintainers' reply as Glow's post quotes it, and the line of the post that says what they did with the report.

is unmaintained, so no fix or release will come from this repository.

Session counts, severity labels beyond the words "high severity", versions of the affected servers and any identifier are not printed by Glow or Help Net Security. Glow says no CVE exists for these vulnerabilities.

The question the report leaves open

Glow's own line is that the model's memory is now a package manager with no deprecation feed. Every other package manager your teams use has an owner, an allowlist and an inventory. If an agent on your estate installed an archived server last month, which of your records would show it, and who would have been told?

Key facts